Description

This curriculum spans the technical and procedural rigor of a multi-phase wireless security engagement, comparable to an internal red team’s assessment workflow, from legal scoping and signal mapping to post-exploitation analysis and remediation planning across enterprise-grade Wi-Fi infrastructures.

Module 1: Scoping and Legal Authorization for Wireless Assessments

Define the boundaries of engagement by identifying which wireless bands (2.4 GHz, 5 GHz, 6 GHz) and protocols (802.11a/b/g/n/ac/ax) are in scope based on client infrastructure.
Obtain written authorization specifying permitted access points, client devices, and testing windows to avoid legal exposure under computer misuse laws.
Negotiate restrictions on deauthentication attacks in production environments where disruption to medical, industrial, or VoIP systems could occur.
Determine whether rogue access point testing includes physical placement or is limited to over-the-air simulation.
Coordinate with legal and compliance teams to align with industry regulations such as HIPAA or PCI DSS when wireless networks handle sensitive data.
Document exceptions for personally owned devices on corporate networks (BYOD) to avoid unauthorized access to non-corporate assets.

Module 2: Wireless Reconnaissance and Signal Mapping

Select RF survey tools (e.g., Ekahau, NetSpot) and configure spectrum analyzers to detect non-802.11 interference from Bluetooth, microwaves, or cordless phones.
Conduct passive packet capture using Kismet or Wireshark to map SSIDs, BSSIDs, channel utilization, and signal strength without triggering IDS alerts.
Perform drive-by or walk-by surveys to identify external wireless coverage leakage beyond physical perimeters.
Correlate GPS-tagged signal data with floor plans to visualize coverage gaps and potential attack entry points.
Distinguish between legitimate access points and lookalike SSIDs using manufacturer OUIs and beacon interval analysis.
Log beacon frame anomalies such as hidden SSIDs with probe response leaks or mismatched supported data rates.

Module 3: Authentication and Association Exploitation

Exploit open authentication flaws by associating with misconfigured access points that allow null or spoofed MAC addresses.
Perform deauthentication attacks using aireplay-ng to force reconnections and capture handshake exchanges, balancing effectiveness against network disruption.
Test for susceptibility to fake access point attacks by broadcasting stronger signals on common SSIDs to lure client associations.
Identify WPA/WPA2-PSK networks using weak pre-shared keys by cross-referencing SSID names with common password patterns.
Assess WPA3 SAE (Simultaneous Authentication of Equals) implementations for side-channel leakage during dragonfly handshake exchanges.
Bypass 802.1X authentication in lab environments by simulating EAP downgrade attacks to legacy protocols like LEAP.

Module 4: Encryption and Key Management Attacks

Capture WPA2 four-way handshakes using packet injection techniques when clients are inactive or connections are infrequent.
Conduct offline dictionary and brute-force attacks using hashcat with optimized GPU rulesets tailored to organizational password policies.
Exploit PMKID capture from RSN IE data in beacon frames to bypass the need for a client handshake in select router models.
Test for weak entropy in WPS PIN implementations and evaluate resistance to brute-force attempts using Reaver or Bully.
Analyze TKIP vs. CCMP usage and prioritize attacks on networks still using deprecated TKIP due to known vulnerabilities.
Assess enterprise-grade key rotation policies by measuring pairwise master key (PMK) lifetime through repeated session captures.

Module 5: Enterprise Wireless Infrastructure Assessment

Enumerate RADIUS server configurations by analyzing EAP exchange types and identifying use of MSCHAPv2, which is vulnerable to credential extraction.
Map VLAN assignments and SSID-to-VLAN mappings to determine potential for lateral movement post-compromise.
Test for misconfigured guest network segmentation that allows direct access to internal subnets or inter-SSID routing.
Identify access points operating in bridged vs. routed mode and evaluate implications for network segmentation and firewall bypass.
Assess controller-based WLAN architectures for default credentials, unpatched firmware, or exposed management interfaces (e.g., HTTP, Telnet).
Validate CAPWAP tunnel encryption between access points and controllers to prevent cleartext exposure of control traffic.

Module 6: Client-Side and Post-Connection Attacks

Exploit Windows Auto-Connect features by broadcasting preferred SSIDs harvested from probe requests to trigger automatic association.
Deploy an evil twin access point with the same ESSID and higher signal strength to intercept client traffic for MITM analysis.
Perform ARP cache poisoning on the wireless subnet to redirect traffic through a testing laptop for packet inspection.
Extract credentials from unencrypted protocols (e.g., HTTP, FTP) captured during client sessions on compromised wireless links.
Test for DNS hijacking susceptibility by responding to client DNS queries with attacker-controlled IP addresses.
Monitor for automatic service discovery protocols (e.g., mDNS, LLMNR) that leak hostnames and enable internal enumeration.

Module 7: Wireless Intrusion Detection and Countermeasure Testing

Evade WIDS/WIPS systems by throttling deauthentication frame rates and randomizing source MAC addresses during attacks.
Test detection rules in enterprise wireless controllers by simulating known attack patterns and measuring alert generation latency.
Assess automated response mechanisms such as rogue AP quarantine or client disassociation for accuracy and false positive rates.
Bypass RF-based detection by operating from shielded locations or using directional antennas to limit signal footprint.
Validate logging completeness by correlating packet capture data with SIEM entries from wireless infrastructure devices.
Recommend tuning parameters for false positives, such as allowing legitimate MAC randomization in BYOD environments.

Module 8: Reporting and Remediation Strategy Development

Classify findings by exploitability, impact, and likelihood—e.g., WEP usage receives critical severity due to trivial decryption.
Map vulnerabilities to MITRE ATT&CK for Enterprise (e.g., T1557 for Man-in-the-Middle) to align with organizational threat models.
Provide remediation steps such as disabling WPS, enforcing WPA3-Enterprise, or implementing 802.11w management frame protection.
Recommend segmentation improvements like dedicated VLANs for IoT devices or isolation of guest traffic at the gateway.
Document configuration baselines for secure wireless deployment, including firmware update schedules and SNMP security settings.
Include evidence artifacts such as packet capture snippets, PMKID hashes, and deauthentication logs to support technical findings.